The GBPR.vbs script groups mailboxes according to the relationships defined
by the permissions that mailbox owners have granted to other users and mailboxes.
One problem you might run into is that any two people in an organization can
be linked through transitive association. In large organizations, the script
generates a massive relationship matrix as it compares these associations and
can sometimes cause an Out of Memory runtime error. You can usually resolve
this problem by running the script on a machine with more memory. At extremely
large sites, I've had to run the script on a server that has 2GB of memory.
To prevent this problem in the first place, you can set a boundary on which
permissions the script considers when determining an association. Listing A shows an excerpt from GBPR.vbs that tells the script which roles to consider
when evaluating an MBInfo file. You can remove roles from consideration by commenting
out selected lines. In the excerpt, the script doesn't consider the Reviewer,
Contributor, or Non-editing Author roles. If you need to consider one of these
roles, simply remove the apostrophe (') at the beginning of each applicable
line. If you don't want the script to consider a role, add an apostrophe to
comment out the appropriate line.
To give you an idea how these changes can affect processing, running the script as shown in Listing A in a site with more than 4400 mailboxes produced 40 groups, with the largest group having 1700 members. Running the script with all roles enabled produced 36 groups, with 2531 members in the largest group.
Another way to govern group size and processing requirements is to limit the number of mailboxes being processed. Permissions are usually granted within site boundaries, so run the script on a site-by-site basis.
As I mention in the main article, Exchange Administrator output can include
domain security groups in the Primary Windows NT Account and Obj-Users fields,
and MBInfo output often includes domain distribution groups (DGs) in its object-permissions
pairs. GBPR.vbs doesn't process relationships that involve permissions granted
to groups. If you need to assess groups, you'll need to modify the script to
expand group memberships before it begins processing relationships.
GBPR.vbs also doesn't consider custom permission sets. The number of custom-permissions
permutations that might be found in MBInfo output is too great for the script
to consider each and every combination, so it considers only the standard permissions
profiles listed in Web Table 1 in the main article.